X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/4b0d56f7e15d2929c973265e3b545e69273b8cb5..4543e85441b758edaf7b4a8f7ed589ca428a9be7:/test/controllers/changeset_comments_controller_test.rb

diff --git a/test/controllers/changeset_comments_controller_test.rb b/test/controllers/changeset_comments_controller_test.rb
index 67df9aa88..33ee1deb5 100644
--- a/test/controllers/changeset_comments_controller_test.rb
+++ b/test/controllers/changeset_comments_controller_test.rb
@@ -10,11 +10,11 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
     )
     assert_routing(
       { :path => "/api/0.6/changeset/comment/1/hide", :method => :post },
-      { :controller => "changeset_comments", :action => "hide_comment", :id => "1" }
+      { :controller => "changeset_comments", :action => "destroy", :id => "1" }
     )
     assert_routing(
       { :path => "/api/0.6/changeset/comment/1/unhide", :method => :post },
-      { :controller => "changeset_comments", :action => "unhide_comment", :id => "1" }
+      { :controller => "changeset_comments", :action => "restore", :id => "1" }
     )
     assert_routing(
       { :path => "/changeset/1/comments/feed", :method => :get },
@@ -129,26 +129,26 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
 
   ##
   # test hide comment fail
-  def test_hide_comment_fail
+  def test_destroy_comment_fail
     # unauthorized
     comment = create(:changeset_comment)
     assert_equal true, comment.visible
 
-    post :hide_comment, :params => { :id => comment.id }
+    post :destroy, :params => { :id => comment.id }
     assert_response :unauthorized
     assert_equal true, comment.reload.visible
 
     basic_authorization create(:user).email, "test"
 
     # not a moderator
-    post :hide_comment, :params => { :id => comment.id }
+    post :destroy, :params => { :id => comment.id }
     assert_response :forbidden
     assert_equal true, comment.reload.visible
 
     basic_authorization create(:moderator_user).email, "test"
 
     # bad comment id
-    post :hide_comment, :params => { :id => 999111 }
+    post :destroy, :params => { :id => 999111 }
     assert_response :not_found
     assert_equal true, comment.reload.visible
   end
@@ -161,33 +161,33 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
 
     basic_authorization create(:moderator_user).email, "test"
 
-    post :hide_comment, :params => { :id => comment.id }
+    post :destroy, :params => { :id => comment.id }
     assert_response :success
     assert_equal false, comment.reload.visible
   end
 
   ##
   # test unhide comment fail
-  def test_unhide_comment_fail
+  def test_restore_comment_fail
     # unauthorized
     comment = create(:changeset_comment, :visible => false)
     assert_equal false, comment.visible
 
-    post :unhide_comment, :params => { :id => comment.id }
+    post :restore, :params => { :id => comment.id }
     assert_response :unauthorized
     assert_equal false, comment.reload.visible
 
     basic_authorization create(:user).email, "test"
 
     # not a moderator
-    post :unhide_comment, :params => { :id => comment.id }
+    post :restore, :params => { :id => comment.id }
     assert_response :forbidden
     assert_equal false, comment.reload.visible
 
     basic_authorization create(:moderator_user).email, "test"
 
     # bad comment id
-    post :unhide_comment, :params => { :id => 999111 }
+    post :restore, :params => { :id => 999111 }
     assert_response :not_found
     assert_equal false, comment.reload.visible
   end
@@ -200,7 +200,7 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
 
     basic_authorization create(:moderator_user).email, "test"
 
-    post :unhide_comment, :params => { :id => comment.id }
+    post :restore, :params => { :id => comment.id }
     assert_response :success
     assert_equal true, comment.reload.visible
   end
@@ -248,4 +248,57 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
     get :index, :params => { :format => "rss", :limit => 100001 }
     assert_response :bad_request
   end
+
+  # This test ensures that token capabilities behave correctly for a method that
+  # requires the terms to have been agreed.
+  # (This would be better as an integration or system testcase, since the changeset_comment
+  # create method is simply a stand-in for any method that requires terms agreement.
+  # But writing oauth tests is hard, and so it's easier to put in a controller test.)
+  def test_api_write_and_terms_agreed_via_token
+    user = create(:user, :terms_agreed => nil)
+    token = create(:access_token, :user => user, :allow_write_api => true)
+    changeset = create(:changeset, :closed)
+
+    # Hack together an oauth request - an alternative would be to sign the request properly
+    @request.env["oauth.version"] = 1
+    @request.env["oauth.strategies"] = [:token]
+    @request.env["oauth.token"] = token
+
+    assert_difference "ChangesetComment.count", 0 do
+      post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+    end
+    assert_response :forbidden
+
+    # Try again, after agreement with the terms
+    user.terms_agreed = Time.now
+    user.save!
+
+    assert_difference "ChangesetComment.count", 1 do
+      post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+    end
+    assert_response :success
+  end
+
+  # This test does the same as above, but with basic auth, to similarly test that the
+  # abilities take into account terms agreement too.
+  def test_api_write_and_terms_agreed_via_basic_auth
+    user = create(:user, :terms_agreed => nil)
+    changeset = create(:changeset, :closed)
+
+    basic_authorization user.email, "test"
+
+    assert_difference "ChangesetComment.count", 0 do
+      post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+    end
+    assert_response :forbidden
+
+    # Try again, after agreement with the terms
+    user.terms_agreed = Time.now
+    user.save!
+
+    assert_difference "ChangesetComment.count", 1 do
+      post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+    end
+    assert_response :success
+  end
 end